blob: a6f18bd7b3f1acf465b2d279518ea1783f413d20 [file] [log] [blame]
William Lallemand03c331c2020-05-13 10:10:01 +02001/*
2 *
3 * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
9 *
10 */
11
12#define _GNU_SOURCE
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020019#include <syslog.h>
William Lallemand03c331c2020-05-13 10:10:01 +020020#include <unistd.h>
21
22#include <sys/stat.h>
23#include <sys/types.h>
24
Willy Tarreaub2551052020-06-09 09:07:15 +020025#include <import/ebsttree.h>
26
Willy Tarreau8d366972020-05-27 16:10:29 +020027#include <haproxy/base64.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020028#include <haproxy/channel.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020029#include <haproxy/cli.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020030#include <haproxy/errors.h>
Willy Tarreau47d7f902020-06-04 14:25:47 +020031#include <haproxy/ssl_ckch.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020032#include <haproxy/ssl_sock.h>
Willy Tarreaub2bd8652020-06-04 14:21:22 +020033#include <haproxy/ssl_utils.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020034#include <haproxy/stream_interface.h>
Willy Tarreau48fbcae2020-06-03 18:09:46 +020035#include <haproxy/tools.h>
William Lallemand03c331c2020-05-13 10:10:01 +020036
William Lallemandda8584c2020-05-14 10:14:37 +020037/* Uncommitted CKCH transaction */
38
39static struct {
40 struct ckch_store *new_ckchs;
41 struct ckch_store *old_ckchs;
42 char *path;
43} ckchs_transaction;
44
45
William Lallemand03c331c2020-05-13 10:10:01 +020046
47/******************** cert_key_and_chain functions *************************
48 * These are the functions that fills a cert_key_and_chain structure. For the
49 * functions filling a SSL_CTX from a cert_key_and_chain, see ssl_sock.c
50 */
51
52/*
53 * Try to parse Signed Certificate Timestamp List structure. This function
54 * makes only basic test if the data seems like SCTL. No signature validation
55 * is performed.
56 */
57static int ssl_sock_parse_sctl(struct buffer *sctl)
58{
59 int ret = 1;
60 int len, pos, sct_len;
61 unsigned char *data;
62
63 if (sctl->data < 2)
64 goto out;
65
66 data = (unsigned char *) sctl->area;
67 len = (data[0] << 8) | data[1];
68
69 if (len + 2 != sctl->data)
70 goto out;
71
72 data = data + 2;
73 pos = 0;
74 while (pos < len) {
75 if (len - pos < 2)
76 goto out;
77
78 sct_len = (data[pos] << 8) | data[pos + 1];
79 if (pos + sct_len + 2 > len)
80 goto out;
81
82 pos += sct_len + 2;
83 }
84
85 ret = 0;
86
87out:
88 return ret;
89}
90
91/* Try to load a sctl from a buffer <buf> if not NULL, or read the file <sctl_path>
92 * It fills the ckch->sctl buffer
93 * return 0 on success or != 0 on failure */
94int ssl_sock_load_sctl_from_file(const char *sctl_path, char *buf, struct cert_key_and_chain *ckch, char **err)
95{
96 int fd = -1;
97 int r = 0;
98 int ret = 1;
99 struct buffer tmp;
100 struct buffer *src;
101 struct buffer *sctl;
102
103 if (buf) {
William Lallemand8d673942021-01-27 14:58:51 +0100104 chunk_initstr(&tmp, buf);
William Lallemand03c331c2020-05-13 10:10:01 +0200105 src = &tmp;
106 } else {
107 fd = open(sctl_path, O_RDONLY);
108 if (fd == -1)
109 goto end;
110
111 trash.data = 0;
112 while (trash.data < trash.size) {
113 r = read(fd, trash.area + trash.data, trash.size - trash.data);
114 if (r < 0) {
115 if (errno == EINTR)
116 continue;
117 goto end;
118 }
119 else if (r == 0) {
120 break;
121 }
122 trash.data += r;
123 }
124 src = &trash;
125 }
126
127 ret = ssl_sock_parse_sctl(src);
128 if (ret)
129 goto end;
130
131 sctl = calloc(1, sizeof(*sctl));
132 if (!chunk_dup(sctl, src)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100133 ha_free(&sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200134 goto end;
135 }
136 /* no error, fill ckch with new context, old context must be free */
137 if (ckch->sctl) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100138 ha_free(&ckch->sctl->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200139 free(ckch->sctl);
140 }
141 ckch->sctl = sctl;
142 ret = 0;
143end:
144 if (fd != -1)
145 close(fd);
146
147 return ret;
148}
149
150#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
151/*
Ilya Shipitsin46a030c2020-07-05 16:36:08 +0500152 * This function load the OCSP Response in DER format contained in file at
William Lallemand03c331c2020-05-13 10:10:01 +0200153 * path 'ocsp_path' or base64 in a buffer <buf>
154 *
155 * Returns 0 on success, 1 in error case.
156 */
157int ssl_sock_load_ocsp_response_from_file(const char *ocsp_path, char *buf, struct cert_key_and_chain *ckch, char **err)
158{
159 int fd = -1;
160 int r = 0;
161 int ret = 1;
162 struct buffer *ocsp_response;
163 struct buffer *src = NULL;
164
165 if (buf) {
166 int i, j;
167 /* if it's from a buffer it will be base64 */
168
169 /* remove \r and \n from the payload */
170 for (i = 0, j = 0; buf[i]; i++) {
171 if (buf[i] == '\r' || buf[i] == '\n')
172 continue;
173 buf[j++] = buf[i];
174 }
175 buf[j] = 0;
176
177 ret = base64dec(buf, j, trash.area, trash.size);
178 if (ret < 0) {
179 memprintf(err, "Error reading OCSP response in base64 format");
180 goto end;
181 }
182 trash.data = ret;
183 src = &trash;
184 } else {
185 fd = open(ocsp_path, O_RDONLY);
186 if (fd == -1) {
187 memprintf(err, "Error opening OCSP response file");
188 goto end;
189 }
190
191 trash.data = 0;
192 while (trash.data < trash.size) {
193 r = read(fd, trash.area + trash.data, trash.size - trash.data);
194 if (r < 0) {
195 if (errno == EINTR)
196 continue;
197
198 memprintf(err, "Error reading OCSP response from file");
199 goto end;
200 }
201 else if (r == 0) {
202 break;
203 }
204 trash.data += r;
205 }
206 close(fd);
207 fd = -1;
208 src = &trash;
209 }
210
211 ocsp_response = calloc(1, sizeof(*ocsp_response));
212 if (!chunk_dup(ocsp_response, src)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100213 ha_free(&ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200214 goto end;
215 }
216 /* no error, fill ckch with new context, old context must be free */
217 if (ckch->ocsp_response) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100218 ha_free(&ckch->ocsp_response->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200219 free(ckch->ocsp_response);
220 }
221 ckch->ocsp_response = ocsp_response;
222 ret = 0;
223end:
224 if (fd != -1)
225 close(fd);
226
227 return ret;
228}
229#endif
230
231/*
232 * Try to load in a ckch every files related to a ckch.
233 * (PEM, sctl, ocsp, issuer etc.)
234 *
235 * This function is only used to load files during the configuration parsing,
236 * it is not used with the CLI.
237 *
238 * This allows us to carry the contents of the file without having to read the
239 * file multiple times. The caller must call
240 * ssl_sock_free_cert_key_and_chain_contents.
241 *
242 * returns:
243 * 0 on Success
244 * 1 on SSL Failure
245 */
246int ssl_sock_load_files_into_ckch(const char *path, struct cert_key_and_chain *ckch, char **err)
247{
William Lallemand8e8581e2020-10-20 17:36:46 +0200248 struct buffer *fp = NULL;
William Lallemand03c331c2020-05-13 10:10:01 +0200249 int ret = 1;
250
251 /* try to load the PEM */
252 if (ssl_sock_load_pem_into_ckch(path, NULL, ckch , err) != 0) {
253 goto end;
254 }
255
William Lallemand8e8581e2020-10-20 17:36:46 +0200256 fp = alloc_trash_chunk();
257 if (!fp) {
258 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
259 goto end;
260 }
261
262 if (!chunk_strcpy(fp, path) || (b_data(fp) > MAXPATHLEN)) {
263 memprintf(err, "%s '%s' filename too long'.\n",
264 err && *err ? *err : "", fp->area);
265 ret = 1;
266 goto end;
267 }
268
William Lallemand089c1382020-10-23 17:35:12 +0200269 /* remove the ".crt" extension */
William Lallemand8e8581e2020-10-20 17:36:46 +0200270 if (global_ssl.extra_files_noext) {
271 char *ext;
272
273 /* look for the extension */
274 if ((ext = strrchr(fp->area, '.'))) {
William Lallemand8e8581e2020-10-20 17:36:46 +0200275
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100276 if (strcmp(ext, ".crt") == 0) {
William Lallemand8e8581e2020-10-20 17:36:46 +0200277 *ext = '\0';
William Lallemand089c1382020-10-23 17:35:12 +0200278 fp->data = strlen(fp->area);
279 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200280 }
281
282 }
283
William Lallemand03c331c2020-05-13 10:10:01 +0200284 /* try to load an external private key if it wasn't in the PEM */
285 if ((ckch->key == NULL) && (global_ssl.extra_files & SSL_GF_KEY)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200286 struct stat st;
287
William Lallemand8e8581e2020-10-20 17:36:46 +0200288
289 if (!chunk_strcat(fp, ".key") || (b_data(fp) > MAXPATHLEN)) {
290 memprintf(err, "%s '%s' filename too long'.\n",
291 err && *err ? *err : "", fp->area);
292 ret = 1;
293 goto end;
294 }
295
296 if (stat(fp->area, &st) == 0) {
297 if (ssl_sock_load_key_into_ckch(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200298 memprintf(err, "%s '%s' is present but cannot be read or parsed'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200299 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200300 goto end;
301 }
302 }
William Lallemand03c331c2020-05-13 10:10:01 +0200303
William Lallemand8e8581e2020-10-20 17:36:46 +0200304 if (ckch->key == NULL) {
305 memprintf(err, "%sNo Private Key found in '%s'.\n", err && *err ? *err : "", fp->area);
306 goto end;
307 }
308 /* remove the added extension */
309 *(fp->area + fp->data - strlen(".key")) = '\0';
310 b_sub(fp, strlen(".key"));
William Lallemand03c331c2020-05-13 10:10:01 +0200311 }
312
313 if (!X509_check_private_key(ckch->cert, ckch->key)) {
314 memprintf(err, "%sinconsistencies between private key and certificate loaded '%s'.\n",
315 err && *err ? *err : "", path);
316 goto end;
317 }
318
Ilya Shipitsinc47d6762021-02-13 11:45:33 +0500319#ifdef HAVE_SSL_SCTL
William Lallemand03c331c2020-05-13 10:10:01 +0200320 /* try to load the sctl file */
321 if (global_ssl.extra_files & SSL_GF_SCTL) {
William Lallemand03c331c2020-05-13 10:10:01 +0200322 struct stat st;
323
William Lallemand8e8581e2020-10-20 17:36:46 +0200324 if (!chunk_strcat(fp, ".sctl") || b_data(fp) > MAXPATHLEN) {
325 memprintf(err, "%s '%s' filename too long'.\n",
326 err && *err ? *err : "", fp->area);
327 ret = 1;
328 goto end;
329 }
330
331 if (stat(fp->area, &st) == 0) {
332 if (ssl_sock_load_sctl_from_file(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200333 memprintf(err, "%s '%s.sctl' is present but cannot be read or parsed'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200334 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200335 ret = 1;
336 goto end;
337 }
338 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200339 /* remove the added extension */
340 *(fp->area + fp->data - strlen(".sctl")) = '\0';
341 b_sub(fp, strlen(".sctl"));
William Lallemand03c331c2020-05-13 10:10:01 +0200342 }
343#endif
344
345 /* try to load an ocsp response file */
346 if (global_ssl.extra_files & SSL_GF_OCSP) {
William Lallemand03c331c2020-05-13 10:10:01 +0200347 struct stat st;
348
William Lallemand8e8581e2020-10-20 17:36:46 +0200349 if (!chunk_strcat(fp, ".ocsp") || b_data(fp) > MAXPATHLEN) {
350 memprintf(err, "%s '%s' filename too long'.\n",
351 err && *err ? *err : "", fp->area);
352 ret = 1;
353 goto end;
354 }
355
356 if (stat(fp->area, &st) == 0) {
357 if (ssl_sock_load_ocsp_response_from_file(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200358 ret = 1;
359 goto end;
360 }
361 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200362 /* remove the added extension */
363 *(fp->area + fp->data - strlen(".ocsp")) = '\0';
364 b_sub(fp, strlen(".ocsp"));
William Lallemand03c331c2020-05-13 10:10:01 +0200365 }
366
367#ifndef OPENSSL_IS_BORINGSSL /* Useless for BoringSSL */
368 if (ckch->ocsp_response && (global_ssl.extra_files & SSL_GF_OCSP_ISSUER)) {
369 /* if no issuer was found, try to load an issuer from the .issuer */
370 if (!ckch->ocsp_issuer) {
371 struct stat st;
William Lallemand8e8581e2020-10-20 17:36:46 +0200372
373 if (!chunk_strcat(fp, ".issuer") || b_data(fp) > MAXPATHLEN) {
374 memprintf(err, "%s '%s' filename too long'.\n",
375 err && *err ? *err : "", fp->area);
376 ret = 1;
377 goto end;
378 }
William Lallemand03c331c2020-05-13 10:10:01 +0200379
William Lallemand8e8581e2020-10-20 17:36:46 +0200380 if (stat(fp->area, &st) == 0) {
381 if (ssl_sock_load_issuer_file_into_ckch(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200382 ret = 1;
383 goto end;
384 }
385
386 if (X509_check_issued(ckch->ocsp_issuer, ckch->cert) != X509_V_OK) {
387 memprintf(err, "%s '%s' is not an issuer'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200388 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200389 ret = 1;
390 goto end;
391 }
392 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200393 /* remove the added extension */
394 *(fp->area + fp->data - strlen(".issuer")) = '\0';
395 b_sub(fp, strlen(".issuer"));
William Lallemand03c331c2020-05-13 10:10:01 +0200396 }
397 }
398#endif
399
400 ret = 0;
401
402end:
403
404 ERR_clear_error();
405
406 /* Something went wrong in one of the reads */
407 if (ret != 0)
408 ssl_sock_free_cert_key_and_chain_contents(ckch);
409
William Lallemand8e8581e2020-10-20 17:36:46 +0200410 free_trash_chunk(fp);
411
William Lallemand03c331c2020-05-13 10:10:01 +0200412 return ret;
413}
414
415/*
416 * Try to load a private key file from a <path> or a buffer <buf>
417 *
418 * If it failed you should not attempt to use the ckch but free it.
419 *
420 * Return 0 on success or != 0 on failure
421 */
422int ssl_sock_load_key_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch , char **err)
423{
424 BIO *in = NULL;
425 int ret = 1;
426 EVP_PKEY *key = NULL;
427
428 if (buf) {
429 /* reading from a buffer */
430 in = BIO_new_mem_buf(buf, -1);
431 if (in == NULL) {
432 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
433 goto end;
434 }
435
436 } else {
437 /* reading from a file */
438 in = BIO_new(BIO_s_file());
439 if (in == NULL)
440 goto end;
441
442 if (BIO_read_filename(in, path) <= 0)
443 goto end;
444 }
445
446 /* Read Private Key */
447 key = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
448 if (key == NULL) {
449 memprintf(err, "%sunable to load private key from file '%s'.\n",
450 err && *err ? *err : "", path);
451 goto end;
452 }
453
454 ret = 0;
455
456 SWAP(ckch->key, key);
457
458end:
459
460 ERR_clear_error();
461 if (in)
462 BIO_free(in);
463 if (key)
464 EVP_PKEY_free(key);
465
466 return ret;
467}
468
469/*
470 * Try to load a PEM file from a <path> or a buffer <buf>
471 * The PEM must contain at least a Certificate,
472 * It could contain a DH, a certificate chain and a PrivateKey.
473 *
474 * If it failed you should not attempt to use the ckch but free it.
475 *
476 * Return 0 on success or != 0 on failure
477 */
478int ssl_sock_load_pem_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch , char **err)
479{
480 BIO *in = NULL;
481 int ret = 1;
482 X509 *ca;
483 X509 *cert = NULL;
484 EVP_PKEY *key = NULL;
485 DH *dh = NULL;
486 STACK_OF(X509) *chain = NULL;
487
488 if (buf) {
489 /* reading from a buffer */
490 in = BIO_new_mem_buf(buf, -1);
491 if (in == NULL) {
492 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
493 goto end;
494 }
495
496 } else {
497 /* reading from a file */
498 in = BIO_new(BIO_s_file());
499 if (in == NULL) {
500 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
501 goto end;
502 }
503
504 if (BIO_read_filename(in, path) <= 0) {
505 memprintf(err, "%scannot open the file '%s'.\n",
506 err && *err ? *err : "", path);
507 goto end;
508 }
509 }
510
511 /* Read Private Key */
512 key = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
513 /* no need to check for errors here, because the private key could be loaded later */
514
515#ifndef OPENSSL_NO_DH
516 /* Seek back to beginning of file */
517 if (BIO_reset(in) == -1) {
518 memprintf(err, "%san error occurred while reading the file '%s'.\n",
519 err && *err ? *err : "", path);
520 goto end;
521 }
522
523 dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
524 /* no need to return an error there, dh is not mandatory */
525#endif
526
527 /* Seek back to beginning of file */
528 if (BIO_reset(in) == -1) {
529 memprintf(err, "%san error occurred while reading the file '%s'.\n",
530 err && *err ? *err : "", path);
531 goto end;
532 }
533
534 /* Read Certificate */
535 cert = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
536 if (cert == NULL) {
537 memprintf(err, "%sunable to load certificate from file '%s'.\n",
538 err && *err ? *err : "", path);
539 goto end;
540 }
541
542 /* Look for a Certificate Chain */
543 while ((ca = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
544 if (chain == NULL)
545 chain = sk_X509_new_null();
546 if (!sk_X509_push(chain, ca)) {
547 X509_free(ca);
548 goto end;
549 }
550 }
551
552 ret = ERR_get_error();
553 if (ret && (ERR_GET_LIB(ret) != ERR_LIB_PEM && ERR_GET_REASON(ret) != PEM_R_NO_START_LINE)) {
554 memprintf(err, "%sunable to load certificate chain from file '%s'.\n",
555 err && *err ? *err : "", path);
556 goto end;
557 }
558
559 /* once it loaded the PEM, it should remove everything else in the ckch */
560 if (ckch->ocsp_response) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100561 ha_free(&ckch->ocsp_response->area);
562 ha_free(&ckch->ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200563 }
564
565 if (ckch->sctl) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100566 ha_free(&ckch->sctl->area);
567 ha_free(&ckch->sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200568 }
569
570 if (ckch->ocsp_issuer) {
571 X509_free(ckch->ocsp_issuer);
572 ckch->ocsp_issuer = NULL;
573 }
574
575 /* no error, fill ckch with new context, old context will be free at end: */
576 SWAP(ckch->key, key);
577 SWAP(ckch->dh, dh);
578 SWAP(ckch->cert, cert);
579 SWAP(ckch->chain, chain);
580
581 ret = 0;
582
583end:
584
585 ERR_clear_error();
586 if (in)
587 BIO_free(in);
588 if (key)
589 EVP_PKEY_free(key);
590 if (dh)
591 DH_free(dh);
592 if (cert)
593 X509_free(cert);
594 if (chain)
595 sk_X509_pop_free(chain, X509_free);
596
597 return ret;
598}
599
600/* Frees the contents of a cert_key_and_chain
601 */
602void ssl_sock_free_cert_key_and_chain_contents(struct cert_key_and_chain *ckch)
603{
604 if (!ckch)
605 return;
606
607 /* Free the certificate and set pointer to NULL */
608 if (ckch->cert)
609 X509_free(ckch->cert);
610 ckch->cert = NULL;
611
612 /* Free the key and set pointer to NULL */
613 if (ckch->key)
614 EVP_PKEY_free(ckch->key);
615 ckch->key = NULL;
616
617 /* Free each certificate in the chain */
618 if (ckch->chain)
619 sk_X509_pop_free(ckch->chain, X509_free);
620 ckch->chain = NULL;
621
622 if (ckch->dh)
623 DH_free(ckch->dh);
624 ckch->dh = NULL;
625
626 if (ckch->sctl) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100627 ha_free(&ckch->sctl->area);
628 ha_free(&ckch->sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200629 }
630
631 if (ckch->ocsp_response) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100632 ha_free(&ckch->ocsp_response->area);
633 ha_free(&ckch->ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200634 }
635
636 if (ckch->ocsp_issuer)
637 X509_free(ckch->ocsp_issuer);
638 ckch->ocsp_issuer = NULL;
639}
640
641/*
642 *
643 * This function copy a cert_key_and_chain in memory
644 *
645 * It's used to try to apply changes on a ckch before committing them, because
646 * most of the time it's not possible to revert those changes
647 *
648 * Return a the dst or NULL
649 */
650struct cert_key_and_chain *ssl_sock_copy_cert_key_and_chain(struct cert_key_and_chain *src,
651 struct cert_key_and_chain *dst)
652{
William Lallemand6c096142021-02-23 14:45:45 +0100653 if (!src || !dst)
654 return NULL;
655
William Lallemand03c331c2020-05-13 10:10:01 +0200656 if (src->cert) {
657 dst->cert = src->cert;
658 X509_up_ref(src->cert);
659 }
660
661 if (src->key) {
662 dst->key = src->key;
663 EVP_PKEY_up_ref(src->key);
664 }
665
666 if (src->chain) {
667 dst->chain = X509_chain_up_ref(src->chain);
668 }
669
670 if (src->dh) {
671 DH_up_ref(src->dh);
672 dst->dh = src->dh;
673 }
674
675 if (src->sctl) {
676 struct buffer *sctl;
677
678 sctl = calloc(1, sizeof(*sctl));
679 if (!chunk_dup(sctl, src->sctl)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100680 ha_free(&sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200681 goto error;
682 }
683 dst->sctl = sctl;
684 }
685
686 if (src->ocsp_response) {
687 struct buffer *ocsp_response;
688
689 ocsp_response = calloc(1, sizeof(*ocsp_response));
690 if (!chunk_dup(ocsp_response, src->ocsp_response)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100691 ha_free(&ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200692 goto error;
693 }
694 dst->ocsp_response = ocsp_response;
695 }
696
697 if (src->ocsp_issuer) {
698 X509_up_ref(src->ocsp_issuer);
699 dst->ocsp_issuer = src->ocsp_issuer;
700 }
701
702 return dst;
703
704error:
705
706 /* free everything */
707 ssl_sock_free_cert_key_and_chain_contents(dst);
708
709 return NULL;
710}
711
712/*
713 * return 0 on success or != 0 on failure
714 */
715int ssl_sock_load_issuer_file_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch, char **err)
716{
717 int ret = 1;
718 BIO *in = NULL;
719 X509 *issuer;
720
721 if (buf) {
722 /* reading from a buffer */
723 in = BIO_new_mem_buf(buf, -1);
724 if (in == NULL) {
725 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
726 goto end;
727 }
728
729 } else {
730 /* reading from a file */
731 in = BIO_new(BIO_s_file());
732 if (in == NULL)
733 goto end;
734
735 if (BIO_read_filename(in, path) <= 0)
736 goto end;
737 }
738
739 issuer = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
740 if (!issuer) {
741 memprintf(err, "%s'%s' cannot be read or parsed'.\n",
742 err && *err ? *err : "", path);
743 goto end;
744 }
745 /* no error, fill ckch with new context, old context must be free */
746 if (ckch->ocsp_issuer)
747 X509_free(ckch->ocsp_issuer);
748 ckch->ocsp_issuer = issuer;
749 ret = 0;
750
751end:
752
753 ERR_clear_error();
754 if (in)
755 BIO_free(in);
756
757 return ret;
758}
759
760/******************** ckch_store functions ***********************************
761 * The ckch_store is a structure used to cache and index the SSL files used in
762 * configuration
763 */
764
765/*
766 * Free a ckch_store, its ckch, its instances and remove it from the ebtree
767 */
768void ckch_store_free(struct ckch_store *store)
769{
770 struct ckch_inst *inst, *inst_s;
771
772 if (!store)
773 return;
774
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200775 ssl_sock_free_cert_key_and_chain_contents(store->ckch);
William Lallemand03c331c2020-05-13 10:10:01 +0200776
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100777 ha_free(&store->ckch);
William Lallemand03c331c2020-05-13 10:10:01 +0200778
779 list_for_each_entry_safe(inst, inst_s, &store->ckch_inst, by_ckchs) {
780 ckch_inst_free(inst);
781 }
782 ebmb_delete(&store->node);
783 free(store);
784}
785
786/*
787 * create and initialize a ckch_store
788 * <path> is the key name
789 * <nmemb> is the number of store->ckch objects to allocate
790 *
791 * Return a ckch_store or NULL upon failure.
792 */
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200793struct ckch_store *ckch_store_new(const char *filename)
William Lallemand03c331c2020-05-13 10:10:01 +0200794{
795 struct ckch_store *store;
796 int pathlen;
797
798 pathlen = strlen(filename);
799 store = calloc(1, sizeof(*store) + pathlen + 1);
800 if (!store)
801 return NULL;
802
William Lallemand03c331c2020-05-13 10:10:01 +0200803 memcpy(store->path, filename, pathlen + 1);
804
805 LIST_INIT(&store->ckch_inst);
806 LIST_INIT(&store->crtlist_entry);
807
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200808 store->ckch = calloc(1, sizeof(*store->ckch));
William Lallemand03c331c2020-05-13 10:10:01 +0200809 if (!store->ckch)
810 goto error;
811
812 return store;
813error:
814 ckch_store_free(store);
815 return NULL;
816}
817
818/* allocate and duplicate a ckch_store
819 * Return a new ckch_store or NULL */
820struct ckch_store *ckchs_dup(const struct ckch_store *src)
821{
822 struct ckch_store *dst;
823
William Lallemand6c096142021-02-23 14:45:45 +0100824 if (!src)
825 return NULL;
826
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200827 dst = ckch_store_new(src->path);
Eric Salama6ac61e32021-02-23 16:50:57 +0100828 if (!dst)
829 return NULL;
William Lallemand03c331c2020-05-13 10:10:01 +0200830
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200831 if (!ssl_sock_copy_cert_key_and_chain(src->ckch, dst->ckch))
832 goto error;
William Lallemand03c331c2020-05-13 10:10:01 +0200833
834 return dst;
835
836error:
837 ckch_store_free(dst);
838
839 return NULL;
840}
841
842/*
843 * lookup a path into the ckchs tree.
844 */
845struct ckch_store *ckchs_lookup(char *path)
846{
847 struct ebmb_node *eb;
848
849 eb = ebst_lookup(&ckchs_tree, path);
850 if (!eb)
851 return NULL;
852
853 return ebmb_entry(eb, struct ckch_store, node);
854}
855
856/*
857 * This function allocate a ckch_store and populate it with certificates from files.
858 */
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200859struct ckch_store *ckchs_load_cert_file(char *path, char **err)
William Lallemand03c331c2020-05-13 10:10:01 +0200860{
861 struct ckch_store *ckchs;
862
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200863 ckchs = ckch_store_new(path);
William Lallemand03c331c2020-05-13 10:10:01 +0200864 if (!ckchs) {
865 memprintf(err, "%sunable to allocate memory.\n", err && *err ? *err : "");
866 goto end;
867 }
William Lallemand03c331c2020-05-13 10:10:01 +0200868
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200869 if (ssl_sock_load_files_into_ckch(path, ckchs->ckch, err) == 1)
870 goto end;
William Lallemand03c331c2020-05-13 10:10:01 +0200871
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200872 /* insert into the ckchs tree */
873 memcpy(ckchs->path, path, strlen(path) + 1);
874 ebst_insert(&ckchs_tree, &ckchs->node);
William Lallemand03c331c2020-05-13 10:10:01 +0200875 return ckchs;
876
877end:
878 ckch_store_free(ckchs);
879
880 return NULL;
881}
882
William Lallemandfa1d8b42020-05-13 15:46:10 +0200883
884/******************** ckch_inst functions ******************************/
885
886/* unlink a ckch_inst, free all SNIs, free the ckch_inst */
887/* The caller must use the lock of the bind_conf if used with inserted SNIs */
888void ckch_inst_free(struct ckch_inst *inst)
889{
890 struct sni_ctx *sni, *sni_s;
891
892 if (inst == NULL)
893 return;
894
895 list_for_each_entry_safe(sni, sni_s, &inst->sni_ctx, by_ckch_inst) {
896 SSL_CTX_free(sni->ctx);
Willy Tarreau2b718102021-04-21 07:32:39 +0200897 LIST_DELETE(&sni->by_ckch_inst);
William Lallemandfa1d8b42020-05-13 15:46:10 +0200898 ebmb_delete(&sni->name);
899 free(sni);
900 }
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +0100901 SSL_CTX_free(inst->ctx);
902 inst->ctx = NULL;
Willy Tarreau2b718102021-04-21 07:32:39 +0200903 LIST_DELETE(&inst->by_ckchs);
904 LIST_DELETE(&inst->by_crtlist_entry);
William Lallemandfa1d8b42020-05-13 15:46:10 +0200905 free(inst);
906}
907
908/* Alloc and init a ckch_inst */
909struct ckch_inst *ckch_inst_new()
910{
911 struct ckch_inst *ckch_inst;
912
913 ckch_inst = calloc(1, sizeof *ckch_inst);
914 if (!ckch_inst)
915 return NULL;
916
917 LIST_INIT(&ckch_inst->sni_ctx);
918 LIST_INIT(&ckch_inst->by_ckchs);
919 LIST_INIT(&ckch_inst->by_crtlist_entry);
920
921 return ckch_inst;
922}
923
William Lallemandda8584c2020-05-14 10:14:37 +0200924/*************************** CLI commands ***********************/
925
926/* Type of SSL payloads that can be updated over the CLI */
927
928enum {
929 CERT_TYPE_PEM = 0,
930 CERT_TYPE_KEY,
931#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
932 CERT_TYPE_OCSP,
933#endif
934 CERT_TYPE_ISSUER,
Ilya Shipitsinc47d6762021-02-13 11:45:33 +0500935#ifdef HAVE_SSL_SCTL
William Lallemandda8584c2020-05-14 10:14:37 +0200936 CERT_TYPE_SCTL,
937#endif
938 CERT_TYPE_MAX,
939};
940
941struct {
942 const char *ext;
943 int type;
944 int (*load)(const char *path, char *payload, struct cert_key_and_chain *ckch, char **err);
945 /* add a parsing callback */
946} cert_exts[CERT_TYPE_MAX+1] = {
947 [CERT_TYPE_PEM] = { "", CERT_TYPE_PEM, &ssl_sock_load_pem_into_ckch }, /* default mode, no extensions */
948 [CERT_TYPE_KEY] = { "key", CERT_TYPE_KEY, &ssl_sock_load_key_into_ckch },
949#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
950 [CERT_TYPE_OCSP] = { "ocsp", CERT_TYPE_OCSP, &ssl_sock_load_ocsp_response_from_file },
951#endif
Ilya Shipitsinc47d6762021-02-13 11:45:33 +0500952#ifdef HAVE_SSL_SCTL
William Lallemandda8584c2020-05-14 10:14:37 +0200953 [CERT_TYPE_SCTL] = { "sctl", CERT_TYPE_SCTL, &ssl_sock_load_sctl_from_file },
954#endif
955 [CERT_TYPE_ISSUER] = { "issuer", CERT_TYPE_ISSUER, &ssl_sock_load_issuer_file_into_ckch },
956 [CERT_TYPE_MAX] = { NULL, CERT_TYPE_MAX, NULL },
957};
958
959
960/* release function of the `show ssl cert' command */
961static void cli_release_show_cert(struct appctx *appctx)
962{
963 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
964}
965
966/* IO handler of "show ssl cert <filename>" */
967static int cli_io_handler_show_cert(struct appctx *appctx)
968{
969 struct buffer *trash = alloc_trash_chunk();
970 struct ebmb_node *node;
971 struct stream_interface *si = appctx->owner;
972 struct ckch_store *ckchs;
973
974 if (trash == NULL)
975 return 1;
976
977 if (!appctx->ctx.ssl.old_ckchs) {
978 if (ckchs_transaction.old_ckchs) {
979 ckchs = ckchs_transaction.old_ckchs;
980 chunk_appendf(trash, "# transaction\n");
William Lallemand5685ccf2020-09-16 16:12:25 +0200981 chunk_appendf(trash, "*%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +0200982 }
983 }
984
985 if (!appctx->ctx.cli.p0) {
986 chunk_appendf(trash, "# filename\n");
987 node = ebmb_first(&ckchs_tree);
988 } else {
989 node = &((struct ckch_store *)appctx->ctx.cli.p0)->node;
990 }
991 while (node) {
992 ckchs = ebmb_entry(node, struct ckch_store, node);
William Lallemand5685ccf2020-09-16 16:12:25 +0200993 chunk_appendf(trash, "%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +0200994
995 node = ebmb_next(node);
996 if (ci_putchk(si_ic(si), trash) == -1) {
997 si_rx_room_blk(si);
998 goto yield;
999 }
1000 }
1001
1002 appctx->ctx.cli.p0 = NULL;
1003 free_trash_chunk(trash);
1004 return 1;
1005yield:
1006
1007 free_trash_chunk(trash);
1008 appctx->ctx.cli.p0 = ckchs;
1009 return 0; /* should come back */
1010}
1011
1012/*
1013 * Extract and format the DNS SAN extensions and copy result into a chuink
1014 * Return 0;
1015 */
1016#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
1017static int ssl_sock_get_san_oneline(X509 *cert, struct buffer *out)
1018{
1019 int i;
1020 char *str;
1021 STACK_OF(GENERAL_NAME) *names = NULL;
1022
1023 names = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1024 if (names) {
1025 for (i = 0; i < sk_GENERAL_NAME_num(names); i++) {
1026 GENERAL_NAME *name = sk_GENERAL_NAME_value(names, i);
1027 if (i > 0)
1028 chunk_appendf(out, ", ");
1029 if (name->type == GEN_DNS) {
1030 if (ASN1_STRING_to_UTF8((unsigned char **)&str, name->d.dNSName) >= 0) {
1031 chunk_appendf(out, "DNS:%s", str);
1032 OPENSSL_free(str);
1033 }
1034 }
1035 }
1036 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
1037 }
1038 return 0;
1039}
1040#endif
1041
1042
1043
1044
1045/* IO handler of the details "show ssl cert <filename>" */
1046static int cli_io_handler_show_cert_detail(struct appctx *appctx)
1047{
1048 struct stream_interface *si = appctx->owner;
1049 struct ckch_store *ckchs = appctx->ctx.cli.p0;
1050 struct buffer *out = alloc_trash_chunk();
1051 struct buffer *tmp = alloc_trash_chunk();
1052 X509_NAME *name = NULL;
1053 STACK_OF(X509) *chain;
1054 unsigned int len = 0;
1055 int write = -1;
1056 BIO *bio = NULL;
1057 int i;
1058
1059 if (!tmp || !out)
1060 goto end_no_putchk;
1061
William Lallemand5685ccf2020-09-16 16:12:25 +02001062 chunk_appendf(out, "Filename: ");
1063 if (ckchs == ckchs_transaction.new_ckchs)
1064 chunk_appendf(out, "*");
1065 chunk_appendf(out, "%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001066
William Lallemand5685ccf2020-09-16 16:12:25 +02001067 chunk_appendf(out, "Status: ");
1068 if (ckchs->ckch->cert == NULL)
1069 chunk_appendf(out, "Empty\n");
1070 else if (LIST_ISEMPTY(&ckchs->ckch_inst))
1071 chunk_appendf(out, "Unused\n");
1072 else
1073 chunk_appendf(out, "Used\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001074
William Lallemand5685ccf2020-09-16 16:12:25 +02001075 if (ckchs->ckch->cert == NULL)
1076 goto end;
William Lallemandda8584c2020-05-14 10:14:37 +02001077
William Lallemand5685ccf2020-09-16 16:12:25 +02001078 chain = ckchs->ckch->chain;
1079 if (chain == NULL) {
1080 struct issuer_chain *issuer;
1081 issuer = ssl_get0_issuer_chain(ckchs->ckch->cert);
1082 if (issuer) {
1083 chain = issuer->chain;
1084 chunk_appendf(out, "Chain Filename: ");
1085 chunk_appendf(out, "%s\n", issuer->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001086 }
William Lallemand5685ccf2020-09-16 16:12:25 +02001087 }
1088 chunk_appendf(out, "Serial: ");
1089 if (ssl_sock_get_serial(ckchs->ckch->cert, tmp) == -1)
1090 goto end;
1091 dump_binary(out, tmp->area, tmp->data);
1092 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001093
William Lallemand5685ccf2020-09-16 16:12:25 +02001094 chunk_appendf(out, "notBefore: ");
1095 chunk_reset(tmp);
1096 if ((bio = BIO_new(BIO_s_mem())) == NULL)
1097 goto end;
1098 if (ASN1_TIME_print(bio, X509_getm_notBefore(ckchs->ckch->cert)) == 0)
1099 goto end;
1100 write = BIO_read(bio, tmp->area, tmp->size-1);
1101 tmp->area[write] = '\0';
1102 BIO_free(bio);
1103 bio = NULL;
1104 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001105
William Lallemand5685ccf2020-09-16 16:12:25 +02001106 chunk_appendf(out, "notAfter: ");
1107 chunk_reset(tmp);
1108 if ((bio = BIO_new(BIO_s_mem())) == NULL)
1109 goto end;
1110 if (ASN1_TIME_print(bio, X509_getm_notAfter(ckchs->ckch->cert)) == 0)
1111 goto end;
1112 if ((write = BIO_read(bio, tmp->area, tmp->size-1)) <= 0)
1113 goto end;
1114 tmp->area[write] = '\0';
1115 BIO_free(bio);
1116 bio = NULL;
1117 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001118
1119#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
William Lallemand5685ccf2020-09-16 16:12:25 +02001120 chunk_appendf(out, "Subject Alternative Name: ");
1121 if (ssl_sock_get_san_oneline(ckchs->ckch->cert, out) == -1)
1122 goto end;
1123 *(out->area + out->data) = '\0';
1124 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001125#endif
William Lallemand5685ccf2020-09-16 16:12:25 +02001126 chunk_reset(tmp);
1127 chunk_appendf(out, "Algorithm: ");
1128 if (cert_get_pkey_algo(ckchs->ckch->cert, tmp) == 0)
1129 goto end;
1130 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001131
William Lallemand5685ccf2020-09-16 16:12:25 +02001132 chunk_reset(tmp);
1133 chunk_appendf(out, "SHA1 FingerPrint: ");
1134 if (X509_digest(ckchs->ckch->cert, EVP_sha1(), (unsigned char *) tmp->area, &len) == 0)
1135 goto end;
1136 tmp->data = len;
1137 dump_binary(out, tmp->area, tmp->data);
1138 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001139
William Lallemand5685ccf2020-09-16 16:12:25 +02001140 chunk_appendf(out, "Subject: ");
1141 if ((name = X509_get_subject_name(ckchs->ckch->cert)) == NULL)
1142 goto end;
1143 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1144 goto end;
1145 *(tmp->area + tmp->data) = '\0';
1146 chunk_appendf(out, "%s\n", tmp->area);
1147
1148 chunk_appendf(out, "Issuer: ");
1149 if ((name = X509_get_issuer_name(ckchs->ckch->cert)) == NULL)
1150 goto end;
1151 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1152 goto end;
1153 *(tmp->area + tmp->data) = '\0';
1154 chunk_appendf(out, "%s\n", tmp->area);
1155
1156 /* Displays subject of each certificate in the chain */
1157 for (i = 0; i < sk_X509_num(chain); i++) {
1158 X509 *ca = sk_X509_value(chain, i);
1159
1160 chunk_appendf(out, "Chain Subject: ");
1161 if ((name = X509_get_subject_name(ca)) == NULL)
William Lallemandda8584c2020-05-14 10:14:37 +02001162 goto end;
1163 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1164 goto end;
1165 *(tmp->area + tmp->data) = '\0';
1166 chunk_appendf(out, "%s\n", tmp->area);
1167
William Lallemand5685ccf2020-09-16 16:12:25 +02001168 chunk_appendf(out, "Chain Issuer: ");
1169 if ((name = X509_get_issuer_name(ca)) == NULL)
William Lallemandda8584c2020-05-14 10:14:37 +02001170 goto end;
1171 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1172 goto end;
1173 *(tmp->area + tmp->data) = '\0';
1174 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001175 }
1176
1177end:
1178 if (ci_putchk(si_ic(si), out) == -1) {
1179 si_rx_room_blk(si);
1180 goto yield;
1181 }
1182
1183end_no_putchk:
1184 if (bio)
1185 BIO_free(bio);
1186 free_trash_chunk(tmp);
1187 free_trash_chunk(out);
1188 return 1;
1189yield:
1190 free_trash_chunk(tmp);
1191 free_trash_chunk(out);
1192 return 0; /* should come back */
1193}
1194
1195/* parsing function for 'show ssl cert [certfile]' */
1196static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx, void *private)
1197{
1198 struct ckch_store *ckchs;
1199
1200 if (!cli_has_level(appctx, ACCESS_LVL_OPER))
1201 return cli_err(appctx, "Can't allocate memory!\n");
1202
1203 /* The operations on the CKCH architecture are locked so we can
1204 * manipulate ckch_store and ckch_inst */
1205 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1206 return cli_err(appctx, "Can't show!\nOperations on certificates are currently locked!\n");
1207
1208 /* check if there is a certificate to lookup */
1209 if (*args[3]) {
1210 if (*args[3] == '*') {
1211 if (!ckchs_transaction.new_ckchs)
1212 goto error;
1213
1214 ckchs = ckchs_transaction.new_ckchs;
1215
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001216 if (strcmp(args[3] + 1, ckchs->path) != 0)
William Lallemandda8584c2020-05-14 10:14:37 +02001217 goto error;
1218
1219 } else {
1220 if ((ckchs = ckchs_lookup(args[3])) == NULL)
1221 goto error;
1222
1223 }
1224
William Lallemandda8584c2020-05-14 10:14:37 +02001225 appctx->ctx.cli.p0 = ckchs;
1226 /* use the IO handler that shows details */
1227 appctx->io_handler = cli_io_handler_show_cert_detail;
1228 }
1229
1230 return 0;
1231
1232error:
1233 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1234 return cli_err(appctx, "Can't display the certificate: Not found or the certificate is a bundle!\n");
1235}
1236
1237/* release function of the `set ssl cert' command, free things and unlock the spinlock */
1238static void cli_release_commit_cert(struct appctx *appctx)
1239{
1240 struct ckch_store *new_ckchs;
1241
1242 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1243
1244 if (appctx->st2 != SETCERT_ST_FIN) {
1245 /* free every new sni_ctx and the new store, which are not in the trees so no spinlock there */
1246 new_ckchs = appctx->ctx.ssl.new_ckchs;
1247
1248 /* if the allocation failed, we need to free everything from the temporary list */
1249 ckch_store_free(new_ckchs);
1250 }
1251}
1252
1253/*
1254 * This function tries to create the new ckch_inst and their SNIs
1255 */
1256static int cli_io_handler_commit_cert(struct appctx *appctx)
1257{
1258 struct stream_interface *si = appctx->owner;
1259 int y = 0;
1260 char *err = NULL;
1261 int errcode = 0;
Remi Tricot-Le Breton43899ec2021-04-21 15:32:46 +02001262 int retval = 0;
William Lallemandda8584c2020-05-14 10:14:37 +02001263 struct ckch_store *old_ckchs, *new_ckchs = NULL;
1264 struct ckch_inst *ckchi, *ckchis;
1265 struct buffer *trash = alloc_trash_chunk();
1266 struct sni_ctx *sc0, *sc0s;
1267 struct crtlist_entry *entry;
1268
1269 if (trash == NULL)
1270 goto error;
1271
1272 if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
1273 goto error;
1274
1275 while (1) {
1276 switch (appctx->st2) {
1277 case SETCERT_ST_INIT:
1278 /* This state just print the update message */
1279 chunk_printf(trash, "Committing %s", ckchs_transaction.path);
1280 if (ci_putchk(si_ic(si), trash) == -1) {
1281 si_rx_room_blk(si);
1282 goto yield;
1283 }
1284 appctx->st2 = SETCERT_ST_GEN;
1285 /* fallthrough */
1286 case SETCERT_ST_GEN:
1287 /*
1288 * This state generates the ckch instances with their
1289 * sni_ctxs and SSL_CTX.
1290 *
1291 * Since the SSL_CTX generation can be CPU consumer, we
1292 * yield every 10 instances.
1293 */
1294
1295 old_ckchs = appctx->ctx.ssl.old_ckchs;
1296 new_ckchs = appctx->ctx.ssl.new_ckchs;
1297
1298 if (!new_ckchs)
1299 continue;
1300
1301 /* get the next ckchi to regenerate */
1302 ckchi = appctx->ctx.ssl.next_ckchi;
1303 /* we didn't start yet, set it to the first elem */
1304 if (ckchi == NULL)
1305 ckchi = LIST_ELEM(old_ckchs->ckch_inst.n, typeof(ckchi), by_ckchs);
1306
1307 /* walk through the old ckch_inst and creates new ckch_inst using the updated ckchs */
1308 list_for_each_entry_from(ckchi, &old_ckchs->ckch_inst, by_ckchs) {
1309 struct ckch_inst *new_inst;
1310 char **sni_filter = NULL;
1311 int fcount = 0;
1312
1313 /* it takes a lot of CPU to creates SSL_CTXs, so we yield every 10 CKCH instances */
1314 if (y >= 10) {
1315 /* save the next ckchi to compute */
1316 appctx->ctx.ssl.next_ckchi = ckchi;
1317 goto yield;
1318 }
1319
1320 if (ckchi->crtlist_entry) {
1321 sni_filter = ckchi->crtlist_entry->filters;
1322 fcount = ckchi->crtlist_entry->fcount;
1323 }
1324
Remi Tricot-Le Bretond817dc72021-01-25 17:19:43 +01001325 if (ckchi->is_server_instance)
William Lallemand795bd9b2021-01-26 11:27:42 +01001326 errcode |= ckch_inst_new_load_srv_store(new_ckchs->path, new_ckchs, &new_inst, &err);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001327 else
1328 errcode |= ckch_inst_new_load_store(new_ckchs->path, new_ckchs, ckchi->bind_conf, ckchi->ssl_conf, sni_filter, fcount, &new_inst, &err);
William Lallemandda8584c2020-05-14 10:14:37 +02001329
1330 if (errcode & ERR_CODE)
1331 goto error;
1332
1333 /* if the previous ckchi was used as the default */
1334 if (ckchi->is_default)
1335 new_inst->is_default = 1;
1336
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001337 new_inst->is_server_instance = ckchi->is_server_instance;
1338 new_inst->server = ckchi->server;
1339 /* Create a new SSL_CTX and link it to the new instance. */
1340 if (new_inst->is_server_instance) {
Remi Tricot-Le Breton43899ec2021-04-21 15:32:46 +02001341 retval = ssl_sock_prepare_srv_ssl_ctx(ckchi->server, new_inst->ctx);
1342 if (retval)
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001343 goto error;
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001344 }
1345
William Lallemanda55685b2020-12-15 14:57:46 +01001346 /* create the link to the crtlist_entry */
1347 new_inst->crtlist_entry = ckchi->crtlist_entry;
1348
William Lallemandda8584c2020-05-14 10:14:37 +02001349 /* we need to initialize the SSL_CTX generated */
1350 /* this iterate on the newly generated SNIs in the new instance to prepare their SSL_CTX */
1351 list_for_each_entry_safe(sc0, sc0s, &new_inst->sni_ctx, by_ckch_inst) {
1352 if (!sc0->order) { /* we initialized only the first SSL_CTX because it's the same in the other sni_ctx's */
1353 errcode |= ssl_sock_prepare_ctx(ckchi->bind_conf, ckchi->ssl_conf, sc0->ctx, &err);
1354 if (errcode & ERR_CODE)
1355 goto error;
1356 }
1357 }
1358
1359
1360 /* display one dot per new instance */
1361 chunk_appendf(trash, ".");
1362 /* link the new ckch_inst to the duplicate */
Willy Tarreau2b718102021-04-21 07:32:39 +02001363 LIST_APPEND(&new_ckchs->ckch_inst, &new_inst->by_ckchs);
William Lallemandda8584c2020-05-14 10:14:37 +02001364 y++;
1365 }
1366 appctx->st2 = SETCERT_ST_INSERT;
1367 /* fallthrough */
1368 case SETCERT_ST_INSERT:
1369 /* The generation is finished, we can insert everything */
1370
1371 old_ckchs = appctx->ctx.ssl.old_ckchs;
1372 new_ckchs = appctx->ctx.ssl.new_ckchs;
1373
1374 if (!new_ckchs)
1375 continue;
1376
1377 /* get the list of crtlist_entry in the old store, and update the pointers to the store */
1378 LIST_SPLICE(&new_ckchs->crtlist_entry, &old_ckchs->crtlist_entry);
1379 list_for_each_entry(entry, &new_ckchs->crtlist_entry, by_ckch_store) {
1380 ebpt_delete(&entry->node);
1381 /* change the ptr and reinsert the node */
1382 entry->node.key = new_ckchs;
1383 ebpt_insert(&entry->crtlist->entries, &entry->node);
1384 }
1385
William Lallemanda55685b2020-12-15 14:57:46 +01001386 /* insert the new ckch_insts in the crtlist_entry */
1387 list_for_each_entry(ckchi, &new_ckchs->ckch_inst, by_ckchs) {
1388 if (ckchi->crtlist_entry)
Willy Tarreau2b718102021-04-21 07:32:39 +02001389 LIST_INSERT(&ckchi->crtlist_entry->ckch_inst, &ckchi->by_crtlist_entry);
William Lallemanda55685b2020-12-15 14:57:46 +01001390 }
1391
William Lallemandda8584c2020-05-14 10:14:37 +02001392 /* First, we insert every new SNIs in the trees, also replace the default_ctx */
1393 list_for_each_entry_safe(ckchi, ckchis, &new_ckchs->ckch_inst, by_ckchs) {
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001394 /* The bind_conf will be null on server ckch_instances. */
1395 if (ckchi->is_server_instance) {
William Lallemande0de0a62021-02-03 18:51:01 +01001396 int i;
William Lallemand3ce6eed2021-02-08 10:43:44 +01001397 /* a lock is needed here since we have to free the SSL cache */
1398 HA_RWLOCK_WRLOCK(SSL_SERVER_LOCK, &ckchi->server->ssl_ctx.lock);
William Lallemand1dedb0a2021-01-26 10:18:57 +01001399 /* free the server current SSL_CTX */
1400 SSL_CTX_free(ckchi->server->ssl_ctx.ctx);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001401 /* Actual ssl context update */
William Lallemand1dedb0a2021-01-26 10:18:57 +01001402 SSL_CTX_up_ref(ckchi->ctx);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001403 ckchi->server->ssl_ctx.ctx = ckchi->ctx;
William Lallemand1dedb0a2021-01-26 10:18:57 +01001404 ckchi->server->ssl_ctx.inst = ckchi;
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001405
William Lallemande0de0a62021-02-03 18:51:01 +01001406 /* flush the session cache of the server */
Willy Tarreau61cfdf42021-02-20 10:46:51 +01001407 for (i = 0; i < global.nbthread; i++)
1408 ha_free(&ckchi->server->ssl_ctx.reused_sess[i].ptr);
1409
William Lallemand3ce6eed2021-02-08 10:43:44 +01001410 HA_RWLOCK_WRUNLOCK(SSL_SERVER_LOCK, &ckchi->server->ssl_ctx.lock);
William Lallemande0de0a62021-02-03 18:51:01 +01001411
William Lallemand1dedb0a2021-01-26 10:18:57 +01001412 } else {
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001413 HA_RWLOCK_WRLOCK(SNI_LOCK, &ckchi->bind_conf->sni_lock);
1414 ssl_sock_load_cert_sni(ckchi, ckchi->bind_conf);
1415 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &ckchi->bind_conf->sni_lock);
1416 }
William Lallemandda8584c2020-05-14 10:14:37 +02001417 }
1418
1419 /* delete the old sni_ctx, the old ckch_insts and the ckch_store */
1420 list_for_each_entry_safe(ckchi, ckchis, &old_ckchs->ckch_inst, by_ckchs) {
William Lallemandda8584c2020-05-14 10:14:37 +02001421
William Lallemand1dedb0a2021-01-26 10:18:57 +01001422 if (ckchi->is_server_instance) {
1423 /* no lock for servers */
1424 ckch_inst_free(ckchi);
1425 } else {
1426 struct bind_conf __maybe_unused *bind_conf = ckchi->bind_conf;
1427
1428 HA_RWLOCK_WRLOCK(SNI_LOCK, &bind_conf->sni_lock);
1429 ckch_inst_free(ckchi);
1430 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &bind_conf->sni_lock);
1431 }
William Lallemandda8584c2020-05-14 10:14:37 +02001432 }
1433
1434 /* Replace the old ckchs by the new one */
1435 ckch_store_free(old_ckchs);
1436 ebst_insert(&ckchs_tree, &new_ckchs->node);
1437 appctx->st2 = SETCERT_ST_FIN;
1438 /* fallthrough */
1439 case SETCERT_ST_FIN:
1440 /* we achieved the transaction, we can set everything to NULL */
Willy Tarreau61cfdf42021-02-20 10:46:51 +01001441 ha_free(&ckchs_transaction.path);
William Lallemandda8584c2020-05-14 10:14:37 +02001442 ckchs_transaction.new_ckchs = NULL;
1443 ckchs_transaction.old_ckchs = NULL;
1444 goto end;
1445 }
1446 }
1447end:
1448
1449 chunk_appendf(trash, "\n");
1450 if (errcode & ERR_WARN)
1451 chunk_appendf(trash, "%s", err);
1452 chunk_appendf(trash, "Success!\n");
1453 if (ci_putchk(si_ic(si), trash) == -1)
1454 si_rx_room_blk(si);
1455 free_trash_chunk(trash);
1456 /* success: call the release function and don't come back */
1457 return 1;
1458yield:
1459 /* store the state */
1460 if (ci_putchk(si_ic(si), trash) == -1)
1461 si_rx_room_blk(si);
1462 free_trash_chunk(trash);
1463 si_rx_endp_more(si); /* let's come back later */
1464 return 0; /* should come back */
1465
1466error:
1467 /* spin unlock and free are done in the release function */
1468 if (trash) {
1469 chunk_appendf(trash, "\n%sFailed!\n", err);
1470 if (ci_putchk(si_ic(si), trash) == -1)
1471 si_rx_room_blk(si);
1472 free_trash_chunk(trash);
1473 }
1474 /* error: call the release function and don't come back */
1475 return 1;
1476}
1477
1478/*
1479 * Parsing function of 'commit ssl cert'
1480 */
1481static int cli_parse_commit_cert(char **args, char *payload, struct appctx *appctx, void *private)
1482{
1483 char *err = NULL;
1484
1485 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1486 return 1;
1487
1488 if (!*args[3])
1489 return cli_err(appctx, "'commit ssl cert expects a filename\n");
1490
1491 /* The operations on the CKCH architecture are locked so we can
1492 * manipulate ckch_store and ckch_inst */
1493 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1494 return cli_err(appctx, "Can't commit the certificate!\nOperations on certificates are currently locked!\n");
1495
1496 if (!ckchs_transaction.path) {
1497 memprintf(&err, "No ongoing transaction! !\n");
1498 goto error;
1499 }
1500
1501 if (strcmp(ckchs_transaction.path, args[3]) != 0) {
1502 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, args[3]);
1503 goto error;
1504 }
1505
William Lallemand5685ccf2020-09-16 16:12:25 +02001506 /* if a certificate is here, a private key must be here too */
1507 if (ckchs_transaction.new_ckchs->ckch->cert && !ckchs_transaction.new_ckchs->ckch->key) {
1508 memprintf(&err, "The transaction must contain at least a certificate and a private key!\n");
1509 goto error;
1510 }
William Lallemanda9419522020-06-24 16:26:41 +02001511
William Lallemand5685ccf2020-09-16 16:12:25 +02001512 if (!X509_check_private_key(ckchs_transaction.new_ckchs->ckch->cert, ckchs_transaction.new_ckchs->ckch->key)) {
1513 memprintf(&err, "inconsistencies between private key and certificate loaded '%s'.\n", ckchs_transaction.path);
1514 goto error;
William Lallemandda8584c2020-05-14 10:14:37 +02001515 }
1516
1517 /* init the appctx structure */
1518 appctx->st2 = SETCERT_ST_INIT;
1519 appctx->ctx.ssl.next_ckchi = NULL;
1520 appctx->ctx.ssl.new_ckchs = ckchs_transaction.new_ckchs;
1521 appctx->ctx.ssl.old_ckchs = ckchs_transaction.old_ckchs;
1522
1523 /* we don't unlock there, it will be unlock after the IO handler, in the release handler */
1524 return 0;
1525
1526error:
1527
1528 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1529 err = memprintf(&err, "%sCan't commit %s!\n", err ? err : "", args[3]);
1530
1531 return cli_dynerr(appctx, err);
1532}
1533
1534
1535
1536
1537/*
1538 * Parsing function of `set ssl cert`, it updates or creates a temporary ckch.
1539 */
1540static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx, void *private)
1541{
1542 struct ckch_store *new_ckchs = NULL;
1543 struct ckch_store *old_ckchs = NULL;
1544 char *err = NULL;
1545 int i;
William Lallemandda8584c2020-05-14 10:14:37 +02001546 int errcode = 0;
1547 char *end;
1548 int type = CERT_TYPE_PEM;
1549 struct cert_key_and_chain *ckch;
1550 struct buffer *buf;
1551
1552 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1553 return 1;
1554
William Lallemandda8584c2020-05-14 10:14:37 +02001555 if (!*args[3] || !payload)
1556 return cli_err(appctx, "'set ssl cert expects a filename and a certificate as a payload\n");
1557
1558 /* The operations on the CKCH architecture are locked so we can
1559 * manipulate ckch_store and ckch_inst */
1560 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1561 return cli_err(appctx, "Can't update the certificate!\nOperations on certificates are currently locked!\n");
1562
William Lallemand5ba80d62021-05-04 16:17:27 +02001563 if ((buf = alloc_trash_chunk()) == NULL) {
1564 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1565 errcode |= ERR_ALERT | ERR_FATAL;
1566 goto end;
1567 }
William Lallemande5ff4ad2020-06-08 09:40:37 +02001568
William Lallemandda8584c2020-05-14 10:14:37 +02001569 if (!chunk_strcpy(buf, args[3])) {
1570 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1571 errcode |= ERR_ALERT | ERR_FATAL;
1572 goto end;
1573 }
1574
1575 /* check which type of file we want to update */
1576 for (i = 0; cert_exts[i].type < CERT_TYPE_MAX; i++) {
1577 end = strrchr(buf->area, '.');
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001578 if (end && *cert_exts[i].ext && (strcmp(end + 1, cert_exts[i].ext) == 0)) {
William Lallemandda8584c2020-05-14 10:14:37 +02001579 *end = '\0';
William Lallemand089c1382020-10-23 17:35:12 +02001580 buf->data = strlen(buf->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001581 type = cert_exts[i].type;
1582 break;
1583 }
1584 }
1585
1586 appctx->ctx.ssl.old_ckchs = NULL;
1587 appctx->ctx.ssl.new_ckchs = NULL;
1588
1589 /* if there is an ongoing transaction */
1590 if (ckchs_transaction.path) {
William Lallemandda8584c2020-05-14 10:14:37 +02001591 /* if there is an ongoing transaction, check if this is the same file */
1592 if (strcmp(ckchs_transaction.path, buf->area) != 0) {
William Lallemand089c1382020-10-23 17:35:12 +02001593 /* we didn't find the transaction, must try more cases below */
1594
1595 /* if the del-ext option is activated we should try to take a look at a ".crt" too. */
1596 if (type != CERT_TYPE_PEM && global_ssl.extra_files_noext) {
1597 if (!chunk_strcat(buf, ".crt")) {
1598 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1599 errcode |= ERR_ALERT | ERR_FATAL;
1600 goto end;
1601 }
1602
1603 if (strcmp(ckchs_transaction.path, buf->area) != 0) {
1604 /* remove .crt of the error message */
1605 *(b_orig(buf) + b_data(buf) + strlen(".crt")) = '\0';
1606 b_sub(buf, strlen(".crt"));
1607
1608 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, buf->area);
1609 errcode |= ERR_ALERT | ERR_FATAL;
1610 goto end;
1611 }
1612 }
William Lallemandda8584c2020-05-14 10:14:37 +02001613 }
1614
1615 appctx->ctx.ssl.old_ckchs = ckchs_transaction.new_ckchs;
1616
1617 } else {
William Lallemandda8584c2020-05-14 10:14:37 +02001618
William Lallemand95fefa12020-09-09 12:01:33 +02001619 /* lookup for the certificate in the tree */
1620 appctx->ctx.ssl.old_ckchs = ckchs_lookup(buf->area);
William Lallemand089c1382020-10-23 17:35:12 +02001621
1622 if (!appctx->ctx.ssl.old_ckchs) {
1623 /* if the del-ext option is activated we should try to take a look at a ".crt" too. */
1624 if (type != CERT_TYPE_PEM && global_ssl.extra_files_noext) {
1625 if (!chunk_strcat(buf, ".crt")) {
1626 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1627 errcode |= ERR_ALERT | ERR_FATAL;
1628 goto end;
1629 }
1630 appctx->ctx.ssl.old_ckchs = ckchs_lookup(buf->area);
1631 }
1632 }
William Lallemandda8584c2020-05-14 10:14:37 +02001633 }
1634
1635 if (!appctx->ctx.ssl.old_ckchs) {
1636 memprintf(&err, "%sCan't replace a certificate which is not referenced by the configuration!\n",
1637 err ? err : "");
1638 errcode |= ERR_ALERT | ERR_FATAL;
1639 goto end;
1640 }
1641
1642 if (!appctx->ctx.ssl.path) {
1643 /* this is a new transaction, set the path of the transaction */
1644 appctx->ctx.ssl.path = strdup(appctx->ctx.ssl.old_ckchs->path);
1645 if (!appctx->ctx.ssl.path) {
1646 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1647 errcode |= ERR_ALERT | ERR_FATAL;
1648 goto end;
1649 }
1650 }
1651
1652 old_ckchs = appctx->ctx.ssl.old_ckchs;
1653
1654 /* duplicate the ckch store */
1655 new_ckchs = ckchs_dup(old_ckchs);
1656 if (!new_ckchs) {
1657 memprintf(&err, "%sCannot allocate memory!\n",
1658 err ? err : "");
1659 errcode |= ERR_ALERT | ERR_FATAL;
1660 goto end;
1661 }
1662
William Lallemand95fefa12020-09-09 12:01:33 +02001663 ckch = new_ckchs->ckch;
William Lallemandda8584c2020-05-14 10:14:37 +02001664
1665 /* appply the change on the duplicate */
1666 if (cert_exts[type].load(buf->area, payload, ckch, &err) != 0) {
1667 memprintf(&err, "%sCan't load the payload\n", err ? err : "");
1668 errcode |= ERR_ALERT | ERR_FATAL;
1669 goto end;
1670 }
1671
1672 appctx->ctx.ssl.new_ckchs = new_ckchs;
1673
1674 /* we succeed, we can save the ckchs in the transaction */
1675
1676 /* if there wasn't a transaction, update the old ckchs */
1677 if (!ckchs_transaction.old_ckchs) {
1678 ckchs_transaction.old_ckchs = appctx->ctx.ssl.old_ckchs;
1679 ckchs_transaction.path = appctx->ctx.ssl.path;
1680 err = memprintf(&err, "Transaction created for certificate %s!\n", ckchs_transaction.path);
1681 } else {
1682 err = memprintf(&err, "Transaction updated for certificate %s!\n", ckchs_transaction.path);
1683
1684 }
1685
1686 /* free the previous ckchs if there was a transaction */
1687 ckch_store_free(ckchs_transaction.new_ckchs);
1688
1689 ckchs_transaction.new_ckchs = appctx->ctx.ssl.new_ckchs;
1690
1691
1692 /* creates the SNI ctxs later in the IO handler */
1693
1694end:
1695 free_trash_chunk(buf);
1696
1697 if (errcode & ERR_CODE) {
1698
1699 ckch_store_free(appctx->ctx.ssl.new_ckchs);
1700 appctx->ctx.ssl.new_ckchs = NULL;
1701
1702 appctx->ctx.ssl.old_ckchs = NULL;
1703
Willy Tarreau61cfdf42021-02-20 10:46:51 +01001704 ha_free(&appctx->ctx.ssl.path);
William Lallemandda8584c2020-05-14 10:14:37 +02001705
1706 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1707 return cli_dynerr(appctx, memprintf(&err, "%sCan't update %s!\n", err ? err : "", args[3]));
1708 } else {
1709
1710 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1711 return cli_dynmsg(appctx, LOG_NOTICE, err);
1712 }
1713 /* TODO: handle the ERR_WARN which are not handled because of the io_handler */
1714}
1715
1716/* parsing function of 'abort ssl cert' */
1717static int cli_parse_abort_cert(char **args, char *payload, struct appctx *appctx, void *private)
1718{
1719 char *err = NULL;
1720
1721 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1722 return 1;
1723
1724 if (!*args[3])
1725 return cli_err(appctx, "'abort ssl cert' expects a filename\n");
1726
1727 /* The operations on the CKCH architecture are locked so we can
1728 * manipulate ckch_store and ckch_inst */
1729 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1730 return cli_err(appctx, "Can't abort!\nOperations on certificates are currently locked!\n");
1731
1732 if (!ckchs_transaction.path) {
1733 memprintf(&err, "No ongoing transaction!\n");
1734 goto error;
1735 }
1736
1737 if (strcmp(ckchs_transaction.path, args[3]) != 0) {
1738 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to abort a transaction for '%s'\n", ckchs_transaction.path, args[3]);
1739 goto error;
1740 }
1741
1742 /* Only free the ckchs there, because the SNI and instances were not generated yet */
1743 ckch_store_free(ckchs_transaction.new_ckchs);
1744 ckchs_transaction.new_ckchs = NULL;
William Lallemandda8584c2020-05-14 10:14:37 +02001745 ckchs_transaction.old_ckchs = NULL;
Willy Tarreau61cfdf42021-02-20 10:46:51 +01001746 ha_free(&ckchs_transaction.path);
William Lallemandda8584c2020-05-14 10:14:37 +02001747
1748 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1749
1750 err = memprintf(&err, "Transaction aborted for certificate '%s'!\n", args[3]);
1751 return cli_dynmsg(appctx, LOG_NOTICE, err);
1752
1753error:
1754 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1755
1756 return cli_dynerr(appctx, err);
1757}
1758
1759/* parsing function of 'new ssl cert' */
1760static int cli_parse_new_cert(char **args, char *payload, struct appctx *appctx, void *private)
1761{
1762 struct ckch_store *store;
1763 char *err = NULL;
1764 char *path;
1765
1766 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1767 return 1;
1768
1769 if (!*args[3])
1770 return cli_err(appctx, "'new ssl cert' expects a filename\n");
1771
1772 path = args[3];
1773
1774 /* The operations on the CKCH architecture are locked so we can
1775 * manipulate ckch_store and ckch_inst */
1776 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1777 return cli_err(appctx, "Can't create a certificate!\nOperations on certificates are currently locked!\n");
1778
1779 store = ckchs_lookup(path);
1780 if (store != NULL) {
1781 memprintf(&err, "Certificate '%s' already exists!\n", path);
1782 store = NULL; /* we don't want to free it */
1783 goto error;
1784 }
1785 /* we won't support multi-certificate bundle here */
William Lallemandbd8e6ed2020-09-16 16:08:08 +02001786 store = ckch_store_new(path);
William Lallemandda8584c2020-05-14 10:14:37 +02001787 if (!store) {
1788 memprintf(&err, "unable to allocate memory.\n");
1789 goto error;
1790 }
1791
1792 /* insert into the ckchs tree */
1793 ebst_insert(&ckchs_tree, &store->node);
1794 memprintf(&err, "New empty certificate store '%s'!\n", args[3]);
1795
1796 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1797 return cli_dynmsg(appctx, LOG_NOTICE, err);
1798error:
1799 free(store);
1800 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1801 return cli_dynerr(appctx, err);
1802}
1803
1804/* parsing function of 'del ssl cert' */
1805static int cli_parse_del_cert(char **args, char *payload, struct appctx *appctx, void *private)
1806{
1807 struct ckch_store *store;
1808 char *err = NULL;
1809 char *filename;
1810
1811 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1812 return 1;
1813
1814 if (!*args[3])
1815 return cli_err(appctx, "'del ssl cert' expects a certificate name\n");
1816
1817 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1818 return cli_err(appctx, "Can't delete the certificate!\nOperations on certificates are currently locked!\n");
1819
1820 filename = args[3];
1821
1822 store = ckchs_lookup(filename);
1823 if (store == NULL) {
1824 memprintf(&err, "certificate '%s' doesn't exist!\n", filename);
1825 goto error;
1826 }
1827 if (!LIST_ISEMPTY(&store->ckch_inst)) {
1828 memprintf(&err, "certificate '%s' in use, can't be deleted!\n", filename);
1829 goto error;
1830 }
1831
1832 ebmb_delete(&store->node);
1833 ckch_store_free(store);
1834
1835 memprintf(&err, "Certificate '%s' deleted!\n", filename);
1836
1837 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1838 return cli_dynmsg(appctx, LOG_NOTICE, err);
1839
1840error:
1841 memprintf(&err, "Can't remove the certificate: %s\n", err ? err : "");
1842 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1843 return cli_dynerr(appctx, err);
1844}
1845
William Lallemandee8530c2020-06-23 18:19:42 +02001846void ckch_deinit()
1847{
1848 struct eb_node *node, *next;
1849 struct ckch_store *store;
1850
1851 node = eb_first(&ckchs_tree);
1852 while (node) {
1853 next = eb_next(node);
1854 store = ebmb_entry(node, struct ckch_store, node);
1855 ckch_store_free(store);
1856 node = next;
1857 }
1858}
William Lallemandda8584c2020-05-14 10:14:37 +02001859
1860/* register cli keywords */
1861static struct cli_kw_list cli_kws = {{ },{
1862 { { "new", "ssl", "cert", NULL }, "new ssl cert <certfile> : create a new certificate file to be used in a crt-list or a directory", cli_parse_new_cert, NULL, NULL },
1863 { { "set", "ssl", "cert", NULL }, "set ssl cert <certfile> <payload> : replace a certificate file", cli_parse_set_cert, NULL, NULL },
1864 { { "commit", "ssl", "cert", NULL }, "commit ssl cert <certfile> : commit a certificate file", cli_parse_commit_cert, cli_io_handler_commit_cert, cli_release_commit_cert },
1865 { { "abort", "ssl", "cert", NULL }, "abort ssl cert <certfile> : abort a transaction for a certificate file", cli_parse_abort_cert, NULL, NULL },
1866 { { "del", "ssl", "cert", NULL }, "del ssl cert <certfile> : delete an unused certificate file", cli_parse_del_cert, NULL, NULL },
1867 { { "show", "ssl", "cert", NULL }, "show ssl cert [<certfile>] : display the SSL certificates used in memory, or the details of a <certfile>", cli_parse_show_cert, cli_io_handler_show_cert, cli_release_show_cert },
1868 { { NULL }, NULL, NULL, NULL }
1869}};
1870
1871INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
1872